CVE-2026-50289

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 5.31.7

Description On Linux, the networkInterfaces() function is susceptible to OS command injection. The issue occurs when the library processes the Debian/Ubuntu interfaces(5) source directive. Specifically, the checkLinuxDCHPInterfaces() function in lib/network.js reads /etc/network/interfaces, extracts a path token from a source directive, and interpolates it unquoted into a shell command executed via execSync(). An attacker who can influence the content of the interfaces(5) configuration file or any file it sources can inject shell metacharacters into the path, leading to arbitrary command execution with the privileges of the Node.js process. This vulnerability is also reachable through getStaticData() and getAllData().

Recommendations Update systeminformation to version 5.31.7 or later. As a temporary workaround, restrict write access to /etc/network/interfaces and any directories sourced by it to prevent unauthorized modification of the configuration files.